CWE-264.

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

• Totalsoft Event Calendar – Calendar (WordPress plugin)
• CWE-264

WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities

• wp-shop.ru WP Shop (WordPress plugin)
• CWE-264

WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

• wpvar.com WP Shamsi (WordPress plugin)
• CWE-264

WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability

• Pop-ups Pop-up (WordPress plugin)
• CWE-264

WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability

• About Rentals. Inc. About Rentals (WordPress plugin)
• CWE-264

WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability

• PHP Crafts Accommodation System (WordPress plugin)
• CWE-264

WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

• Alessio Caiazza About Me (WordPress plugin)
• CWE-264

WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability

• The Beaver Builder Team Beaver Builder – WordPress Page Builder (WordPress plugin)
• CWE-264

WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability

• YooMoney ЮKassa для WooCommerce (WordPress plugin)
• CWE-264

WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability

• THE Leads Management System: 59sec LITE (WordPress plugin)
• CWE-264

WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

• miniOrange WP OAuth Server (WordPress plugin)
• CWE-264

WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities

• StoreApps Affiliate For WooCommerce (WordPress plugin)
• CWE-264

WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability

• Biplob018 Shortcode Addons (WordPress plugin)
• CWE-264

WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability

• Biplob Adhikari Tabs (WordPress plugin)
• CWE-264

WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability

• Biplob Adhikari Flipbox (WordPress plugin)
• CWE-264

WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities

• Social Share Buttons by Supsystic (WordPress plugin)
• CWE-264

WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability

• biplob018 Shortcode Addons (WordPress plugin)
• CWE-264

WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability

• Biplob Adhikari Accordions (WordPress plugin)
• CWE-264

Elastic Endpoint Security: A local privilege escalation (LPE) issue was discovered in the ransomware canaries…

• Elastic Endpoint Security
• CWE-264

User account escalation in Apache Hadoop

• Path traversal
• Insecure deserialization

>=2.2.0, <2.10.2 || >=3.0.0, <3.2.3 || >=3.3.0, <3.3.2 · fixed in 2.10.2, 3.2.3, 3.3.2

Platinum Mobile MobileHandler.ashx access control

• Platinum Mobile
• CWE-264

Moodle does not revoke role capabilities correctly

• CWE-264
• CWE-273

>=3.5.0, <3.5.9 || >=3.6.0, <3.6.7 || >=3.7.0, <3.7.3 · fixed in 3.5.9, 3.6.7, 3.7.3

WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability

• Adam Skaat Countdown & Clock (WordPress plugin)
• CWE-264

Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.

• Mattermost Playbooks
• CWE-264

WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability

• Cloudways Breeze (WordPress plugin)
• Cross-site scripting (XSS)
• CWE-264

Rapid7 Insight Agent Privilege Escalation

• Rapid7 Insight Agent
• CWE-264

V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.

• LG webOS TV
• CWE-264

Elasticsearch privilege escalation

• Privilege escalation
• CWE-264

>=7.16.0, <7.17.1 · fixed in 7.17.1

Elastic kibana: A flaw was discovered in Kibana in which users with Read access to the Uptime feature…

• Elastic kibana
• CWE-264

SQL injection in Apache DolphinScheduler

• SQL injection
• CWE-264

<1.3.6 · fixed in 1.3.6

SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information.

• Samsung Mobile Devices
• CWE-264

An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth information.

• Samsung Mobile Devices
• CWE-264

WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

• StylemixThemes uListing (WordPress plugin)
• CWE-264

Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…

• Arista Metamako Operating System
• CWE-264

Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'

• GNU Guix guix-daemon
• CWE-264

FAQ articles are shown to users without permission

• OTRS AG FAQ
• OTRS
• CWE-264

Config Items are shown to users without permission

• OTRS AG OTRSCIsInCustomerFrontend
• OTRS AG ITSMConfigurationManagement
• CWE-264

Changing the password on the module webpage does not require the user to type in the current password first.

• ICX35-HWC-A, ICX35-HWC-E
• CWE-264

privilege escalation

• Micro Focus Solutions Business Manager
• CWE-264

Agent is able to link customer's Config Items without permission

• OTRS AG OTRSCIsInCustomerFrontend
• CWE-264

Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability

• Cisco AnyConnect Secure Mobility Client
• CWE-264

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

• CWE-264

* · no fixed version yet

Cisco IOS Software for Cisco Industrial Routers Virtual-LPWA Unauthorized Access Vulnerability

• Cisco IOS 15.2(6)E4
• CWE-264

Cisco Unified Customer Voice Portal Insecure Direct Object Reference Vulnerability

• Cisco Unified Customer Voice Portal (CVP)
• CWE-264

Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability

• Cisco IOS XR Software
• CWE-264

Cisco IOS XR Authenticated User Privilege Escalation Vulnerability

• Cisco IOS XR Software
• CWE-264

Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability

• Cisco Smart Software Manager On-Prem
• CWE-264

Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability

• Cisco Vision Dynamic Signage Director
• CWE-264

GOG Galaxy GalaxyClientService Privilege Escalation

• GOG GalaxyClientService
• CWE-264

local snapd exploit through cloud-init

• Canonical snapd
• Canonical core
• CWE-264

Rockwell Automation FactoryTalk View SE

• Rockwell Automation FactoryTalk View SE
• CWE-264

Cisco SD-WAN Solution Software Privilege Escalation Vulnerability

• Cisco SD-WAN Solution
• CWE-264

Cisco SD-WAN Solution Software Static Credentials Vulnerability

• Cisco SD-WAN vManage
• CWE-264

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

• Cisco IOS XE Software 16.2.2
• CWE-264

Cisco IOx for IOS XE Software Privilege Escalation Vulnerability

• Cisco IOS XE Software 16.3.1
• CWE-264

Cisco IOS XE Software Privilege Escalation Vulnerability

• Cisco IOS XE Software 3.8.0S
• CWE-264

Cisco IOS XE Software Privilege Escalation Vulnerability

• Cisco IOS XE Software 16.11.1
• CWE-264

Cisco IOS XE Software Privilege Escalation Vulnerability

• Cisco IOS XE Software 3.8.0S
• CWE-264

Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass Vulnerability

• Cisco IOS 12.2(60)EZ16
• CWE-264

Privilege escalation via B&R Automation Studio upgrade service

• B&R Automation Studio
• CWE-264